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Foreword 

The Montana Information Technology Act (MITA) requires that the Department of 
Administration (DO A) prepare a report each biennium that assesses the state's progress in 
achieving the goals and initiatives outlined in the state's Information Technology Strategic Plan. 
MITA also requires that the report contain an analysis of the state's information technology (IT) 
infrastructure including its value, condition, capacity; an inventory of IT equipment, software and 
services; and an evaluation of IT performance. This document is the third biennial IT report and 
measures our progress against the state's second IT strategic plan which was developed in the 
spring of 2004. 

The focus of the Biennial Report is the executive branch. The legislative branch, judicial branch, 
and university system are generally excluded since MITA was not designed to cover those 
organizations. 

The background material for this report originated from several primary sources: 

• Expenditure and budget data from the Office of Budget and Program Services and the 
System Audit Statewide Accounting, Budgeting and Human Resource System 
(SABHRS). 

• Agency IT plans. 

• Project data assembled by the Information Technology Service Division's (ITSD) Project 
Management Office. 

• ITSD web survey application. Agency staff used this application to log information on 
their servers, applications, and progress against their strategic plans. 

The Biennial Report is a summary of dozens of detailed reports, spreadsheets, analysis 
documents, SABHRS queries, and independent research. The detailed material can be found in 
the appendices, but the appendices are not published in hardcopy due to their length. Appendices 
are available in hardcopy by request and through the web at: 
http://itsd.mt.gov/techmt/biennialreport.asp 

If you have any questions regarding the data reported here, or the use of information technology 
within the State of Montana, please contact the Information Technology Services Division of the 
Department of Administration. 
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Progress on the State Strategic Plan for Information Technology 2004 

ITSD adopted the use of Enterprise Risk Management (ERM) and Control Objectives for 
Information and Related Technologies (COBIT) to formalize risk management and provide 
control objectives for IT. This is one use of deploying Enterprise Architecture (EA) as a tool for 
managing change in an organization. In 2006 the CIO implemented the state of Montana 
Information Technology Resource Planning and Development Cycle. The purpose was to define a 
coordinated and integrated approach to manage the development of information technology 
resources needed to support the strategic missions of the state of Montana. 

There has been significant growth in the use of e-government applications over the last two 
years. With 14,252 registered users; transactions were up from 1,788,768 in FY05 to 1,998,093 in 
FY06, representing an increase of 1 1.7 percent. We expect to see continued growth in this area 
since 57.1 percent of Montana households have computers and 62.8 percent of all Montanans use 
the Internet. 

We continue to make progress on the Implementation of Best Practices. There has been 
increased utilization of qualified project managers and the use of independent verification and 
validation processes on major projects. Major IT projects are aligned with the agencies' IT Plans 
which are aligned to the state's IT Strategic Plan. All major projects are reviewed as part of the 
IT Strategic Plan approval process and the Executive Planning Process review. The Policy and 
Planning Services Bureau has established a project management office and maintains an ongoing 
inventory of the state's IT infrastructure. 

The IT Policy Process was developed as the primary policy and standard development process, 
and provides for the development, review, publishing, and implementation of statewide and ITSD 
IT policies, standards and supporting processes. These processes will also provide for the 
development and implementation of procedures, guidelines, and white papers. This will improve 
the business process management within ITSD. Since the project's inception, several policies, 
standards and procedures have been developed and work is in progress to address enterprise IT 
planning, project management and procurement via policy. 

Workforce development continues to be a challenge within the IT arena. As a whole, the state of 
Montana is below industry standards on the number of IT staff as a ratio to total employees 
supported by IT. Additionally, many key IT positions remain unfilled due to hiring difficulties 
directly related to the prevailing wage the state pays for IT professionals. As a result of the low 
wages relevant to the prevailing market rate, the agencies are often left with a small pool of less 
qualified applicants. This severity of this situation is expected to increase as the aging state 
employee population moves to retirement. 

Public Safety Communications continues to expand and improve within the state of Montana. 
Montana has 57 Public Safety Answering Points (PSAP's), all of which provide basic 9-1-1 
service. Wire and wireless Enhanced 9-1-1 (E9-1-1,) service enables law enforcement and public 
safety agencies to respond quicker by providing the dispatcher with critical location information 
for a caller on a wireless phone. There are 28 PSAP's that provide E9-1-1 service and 20 more 
that have agreed to provide E 9-1-1 services. Primary E9-1-I service is provided by Century Tel. 
A few large PSAP's at urban centers also use Qwest. The statewide E9-1-1 service allows Public 
Safety Answering Points (PSAP's) to acquire the hardware and DBMS/ALI database 
functionality as a service and pay for these services on a recurring monthly basis versus 
purchasing and maintaining the system themselves. 



The concept of a connected and compatible statewide Public Safety Land Mobile Radio System 

(LMR) in Montana has been discussed and studied for over 20 years. Local public safety systems 
were built on a local needs basis, often with no coordination with other response groups in 
regional areas. Following the events of 9-1 1, there was an intense focus on homeland security 
and the inability of agencies to communicate effectively with each other during an emergency. 
In 2004 Lewis and Clark County initiated a project to upgrade their voice radio system to a 
combined trunked/conventional P25 Motorola system. The statewide Interoperability Executive 
Council (SIEC) adopted Project 25 digital standard as the underlying technology architecture to 
ensure interoperable communication. All state of Montana agencies using digital voice 
communications are required to conform to the P25 standard. The Disaster and Emergency 
Services (DES) division, the administrator for Homeland Security funding, now require the P25 
standard for state and local purchases. 

The Northern Tier Interoperability Consortium (NTIC) was born from law enforcement concerns 
regarding the lack of communication interoperability along the Canadian Border. The NTIC was 
organized in 2004, involving 12 counties and 4 tribal nations. In 2005, the NTIC voted to follow 
the Lewis and Clark Model for their system. DES provided approximately $7.5 million of 
homeland security funding to initiate the project and the 2005 Montana Legislature allocated $3.5 
million to the NTIC project. 

ITSD, DES, and eight consortia have proposed expansion of the Lewis and Clark County design 
to a statewide approach by forming the Interoperability Montana Project (IM.) The 
Interoperability Montana Project has identified the expansion of the trunked radio system and 
digital microwave system as an expansion of the Lewis and Clark and the Northern Tier Projects. 
The phase one expansion will involve the improvement and development of up to seventeen sites 
in 2007, with additional sites to be added depending on funding. Several state agencies, including 
the Montana Highway Patrol and Department of Livestock, plan to utilize the Interoperability 
Montana system immediately. A number of other state agencies are examining the extent they 
will support and utilize the IM system as it deploys. 



Progress on Agency Information Technology Plans 

Each state agency developed a specific agency IT plan in the spring of 2004 for the subsequent 
six years, focusing on the next biennium. All 3 1 agencies in the executive branch submitted plans. 
Each of these agency plans contained detailed goals and supporting objectives for IT as well as 
descriptions of any significant IT initiatives the agency was undertaking. In all, they proposed 
161 separate goals, supported by 510 specific objectives. Agencies were asked to report their 
progress in meeting these objectives on the following scale: Completed, Currently ongoing as 
planned, Currently ongoing but behind schedule and Not started. Agencies reported that more 
than 75 percent of all objectives have either been accomplished or are on schedule. The remaining 
objectives are equally divided between those simply below expectations and those that for various 
reasons were not started at all (often due to lack of funds, change in agency focus, or federal 
changes). 

Agencies were also asked to report on how well they are doing on major IT initiatives (typically 
spends in excess of $300,000 or more than 25 percent of their IT budget.) There were 94 such 
initiatives planned in 2004. Of these nearly 80 percent are completed or on schedule. Only 6 
percent are below expectations and 15 percent were never started. 



Agency Progress Against Plan 
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Figure 1 illustrates progress agencies made against their IT Plans. 



MITA Audit and Response 

In October 2005 the Enterprise IT Management Audit Report (LAD #05DP-06) was published 
with four findings relative to DOA's implementation of the Montana Information Technology Act 
(MITA). The report required DOA to do the following: 

1. Commit to and execute the centralized management and control of IT required by MITA. 

2. Develop and document implementation plans addressing each section of MITA. 

3. A. Establish and document the process of using policies to ensure DOA and state 

agencies comply with MITA. 
B. Establish and document procedures to maintain enterprise IT policies and standards. 

4. Coordinate with the Office of Budget and Program Planning to enforce the statutory 
requirement that new IT investments be included in the governor's budget only if the 
project is included in the approved agency information technology plan. 

The CIO Policy Project and dedicated policy team was established in response to the audit 
findings 2 and 3. The project advances this goal through the development and implementation of 
statewide IT policies and standards. 

The IT Policy Process was developed as the primary policy and standard development process, 
and provides for the development, review, publishing, and implementation of statewide and ITSD 
IT policies. Standards and supporting processes will provide for the development and 
implementation of procedures, guidelines and white papers. 

Key practices in the development of policies and standards is the use of Enterprise Risk 
Management (ERM) and Control Objectives for Information and Related Technologies (COBIT) 
to formalize risk management and provide control objectives for IT. 

The policy team is currently developing three primary policies on IT procurement, IT planning, 
and IT project management. Ten documents consisting of policies, standards, and strategy white 
papers have been published. An additional 1 1 policies/standards and 5 strategy white papers are 
also under development. 

Finding 4 is being addressed through the Office of Budget and Program Planning and DOA/ITSD 
coordinated efforts on reviewing and evaluating major IT projects. They issued a joint survey on 
IT EPP requests in August 2006, and all major IT project requests that DOA/ITSD receives are 
being distributed to OBPP. This includes all agency proposals for data center expansions. In 
addition, this Biennial Report contains a section on major IT projects that includes information on 
all IT projects regardless of their source of funding. DOA/ITSD requires agencies to update their 
agency IT plans before approving major new IT projects. 

The Enterprise IT Management Audit Report (LAD #05DP-06) and DOA response can be found 
at http://leg.mt.gov/css/audit/audit_reports_year.asp 



Status of the Information Technology Infrastructure 

The Information Technology Service Division maintains a web based application that allows 
agencies to input data relative to the current status of their IT inventory. Agencies are required to 
maintain current information in the database, making entries as changes occur, and performing 
annual updates as requested by ITSD. The following section of this report reflects an analysis of 
that data as reported by the agencies. 



Data Centers 

There are 293 sites housing 934 physical servers, which store and run the state's software 
applications. Due to their critical nature, data centers are typically designed to have special 
environmental protections in place. The typical protections include: 

HVAC (heating, ventilation, air-conditioning) 

Fire suppression systems 

Conditioned power source to eliminate voltage drops and peaks 

Battery backup for power during temporary outages 

Local/controlled access 

Generators for alternate power source over extended periods 



Server Protection Level by Type 
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■ Sites Covered ■ Servers Covered 
Figure 2 illustrates the percentage of servers and sites covered by the typical protective systems. 

There appears to be great disparity among the levels of protection installed for the state's data 
centers. The larger data centers typically have most of the standard protective systems listed 
above; however, many of the smaller data centers have few or none of the critical protective 
systems in place. 
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Figure 3 illustrates the level of protection for state servers. 

While only three sites (?/ze /r^Z) data center in the Mitchell Building, DOJat Fort Harrison, and 
MDT) have all six levels of protection, 295 or 32 percent of the state's servers are located at those 
three locations. There are 601 or 64 percent of the state's servers located in sites with four or 
more protections. A total of 157 or 17 percent of servers are in isolated locations that have one or 
no protection. 

Servers 

By definition, a server is a multi-user computer that provides a specific type of service to client 
software running on other computers - usually PCs. For our purpose, the term server refers to a 
physical or virtual computer on which server software is running. A single server may have 
many applications running on it; therefore, the server may provide many different services to 
many different users on the network. Servers in this report include everything from a large 
mainframe down through mid-tier size servers and include large desktop computers if they are 
operating as servers. 

The state has 934 servers in operation housing more than 1076 physical or virtual servers. With 
appropriate software, dozens of virtual servers may reside on a single physical server. ITSD, 
DOJ, and STF use this technique to reduce the number of physical servers, simplify management, 
and minimize software-licensing cost. 

There are 50 servers dedicated to running Storage Area Networks (SANs) for the purpose of 
backing up and storing large amounts of critical data. There are 10 agencies that are currently 
employing SANs: COR, DEQ, DLI, FWP, LEG, MDT, MSL, OPI, SOS, and STF. 



Servers by Manufacturer 
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Figure 4 illustrates servers by manufacturer. 

Dell and IBM make up the largest portion of the state's servers, about 80 percent. With the 
merger of Compaq and Hewlett-Packard (HP) almost 14 percent of the state's servers are 
supported by HP. 

Operating Systems 

The operating system controls the other application software running on the server. Presently, 
Windows is the predominant server operating system within the enterprise landscape. There are 
fourteen separate operating systems currently in use throughout the state. This diversity 
contributes to the complexity associated with providing support and planning future growth 
strategies, while maintaining the enterprise infrastructure. 
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Figure 5 illustrates the server operating system by type. 



Age 

Of the 934 servers identified within the survey, 79 percent are four years old or newer. Most 
hardware vendors commit to five years of parts availability for servers; therefore, five years is the 
reasonable upper limit for the life of a deployed server. 
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Figure 6 illustrates the age distribution of servers identified within the agency. 

Applications 

Software applications are used to carry out a wide variety of functions performed by agencies 
within state government. These functions support internal, state-related business processes as well 
as external, public-related business transactions. The survey data does not reflect single-user 
applications. 

Our applications are divided into three major categories; commercially available and procured, 
custom built, or a database (data storage) application. Only 16 percent of the applications used 
by the state of Montana are commercially available products. Approximately 43 percent are 
custom built to meet the unique needs of the state, or because a commercial application was not 
available. 
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Figure 7 illustrates the breakdown of the state's major applications by type. 



Applications were rated by the agencies to determine their relative age, ranging from new to 
obsolete for current purposes. A total of 107 applications are currently classified as "declining" 
in age or obsolete, 62 of which are custom applications that will need to be upgraded or replaced 
in the near to immediate future. 

Software lifecycle is predicated on the type of software and hardware platform being used. Any 
one of the following factors may require the replacement or updating of software: hardware 
equipment changes, operating system changes, user needs, manufacture updates and termination 
of support for older versions. At a minimum, operating system software upgrades should be timed 
to coincide with normal hardware replacement or when application/middleware is undergoing a 
major upgrade. 

Agencies will need to address lifecycle management of their software applications in their agency 
IT plans. 



Age of Applications 
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Figure 8 illustrates applications by type and by age. 

Applications were also rated for their level of criticality to the continued operation of state 
businesses. The agencies were asked to indicate whether the application has a disaster recovery 
plan in place. Nearly 78 percent of all applications do not have a disaster recovery plan, 240 of 
which are highly critical to state operations. 



State Critical Applications 
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Figure 9 illustrates applications critical to state operations with an indication of the status of their 
recovery plan. 

The applications were also rated for their level of criticality to the continued operation of the 
agency business. A scale of high, medium, or low was used. Approximately 68 percent of the 
applications rated as critical to agency operation do not have a disaster recovery plan. 
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Figure 10 illustrates the agency rating, along with the status of the disaster recover plan. 

Desktop Computers 

Montana currently has 13,670 personal computers in service, with 2005 or 14.6 percent of those 
being laptop computers, and the remainder being desktop computers. There has been a 3 percent 
increase in the number of personal computers from 2004 to 2006. The state's PC-standard is 
based on IBM and IBM-compatible equipment and selected software. The state has a term 
contract with IBM, Dell, and HP for PC acquisitions. While there has only been a moderate 
growth in the number of PCs, the number of laptops is increasing while the overall number of 
desktop PC's remained level during 2005 and 2006. 
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The state's policy for PC replacement is once every four years, which is consistent with industry 
and government practices. The actual PC replacement rate for fiscal year 05 and fiscal year 06 
averaged 19 percent for desktop computers and 17.5 percent for laptop computers. 



Personal Computers in Use 
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Figure 11 illustrates how the number of personal computers in use by the state has 
increased over time. 

Agencies will need to replace a minimum of 3,229 personal computers within the next biennium 
in order to maintain the state's policy for PC replacement of once every four years. At an 
approximate cost of $1,500 per unit, the projected investment will be $4.8 million. Most agencies 
have not adhered to the 25 percent a year replacement schedule and will therefore require a larger 
capital expenditure in order to become current with state policy. 

Beginning is January 2007, new computers will start shipping with the new Windows Vista 
operating system and we can expect to see changes in the associated office suites such as Office 
2007. The state will be faced with evaluating upgrades and enterprise compatibility issues. 




■ <1 Year ■ 1-2 Year n 2-3 Year □ 3-4 Year ■ > 4 Year 
Figure 12 illustrates the distribution of personal computers by age. 
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Mainframe Computing Environment 

The state has operated a centralized mainframe computer for many years. The state currently 
operates an IBM zSeries 800 Mainframe. In recent years, agencies' demand for mainframe 
computing services has declined as they have turned to a mid-tier computing environment for 
application processing and delivery of web eGovernment services. This movement is consistent 
with nation-wide trends. Currently, nearly 90 percent of the workload on the state's mainframe 
computer comes from three agencies, and these agencies have plans to migrate their applications 
to a mid-tier environment within the next 1 8 to 48 months. After this migration has occurred, the 
operating costs for the mainframe computer will remain nearly at their current level. The few 
remaining agency applications will then have the full cost burden of supporting the mainframe 
computing environment unless a different cost recovery method is implemented. The state must 
develop a strategy for managing this migration, including a plan to finance the continuing 
mainframe operations and IT staffing support. 

Mid-Tier Computing Environment 

Mid-Tier computers are generally much smaller than traditional mainframe computers and larger 
than "personal computers." These systems rely on the Unix, Windows and Linux operating 
systems. The vast majority of applications developed in the past ten years have been aimed at the 
mid-tier platform. Mid-tier has become the predominant platform for database services, 
application processing, and web services. 

Mid-tier computing has grown dramatically as the demand for database services, application 
processing, and web-services has grown. Similarly, the need for high availability and redundancy 
has added to mid-tier cost and support staff work load. Smaller agencies have difficulty retaining 
support staff, and critical practices, such as disaster recovery, often receive less attention than 
they should. To provide the best value to the state for dollar expended and to provide the best 
service to agencies and the citizens they serve, centralization and consolidation should be 
aggressively pursued. 

Telecommunications Network Infrastructure 

SummitNet II is the integrated voice, data, and video network used by government agencies, 
University System, libraries, local governments, and K-I2 educational institutions. Multiple 
telecommunications carriers throughout the state provide SummitNet II. High-speed ATM 
switches located in many of the larger Montana urban areas connect their respective communities 
and university campus' together. Additionally, VisionNet has deployed ATM switches in 
additional communities not supported by Qwest via their independent network of telephone 
service providers. 
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Figure 13 illustrates the Areas Serviced by SummitNet II 



There are two high-speed connections between the Helena Capital Complex and the state's major 
telecommunications carriers, Qwest and VisionNet. These circuits are carefully monitored and 
protected by the Office of Cyber Protection (OCP) within ITSD. OCP manages intrusion 
detection, spam detection and virus scanning systems to protect desktops, servers and applications 
residing on the network. The network currently has 476 circuits that service over 550 sites. 
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Figure 14 illustrates the growth in the number of circuits and sites serviced by the nettvork. 
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The majority of remote SummitNet II connections are currently T-l (1,544,000 bits per second) 
frame relay. The state has been working with Qwest and VisionNet to obtain higher speed 
connections. As a result of these efforts, Qwest expanded frame relay services to Lewistown, 
Shelby, Cut Bank and Conrad. These new services have allowed ITSD to upgrade remote 
connections from 56Kbps to 1.544Mbps (1,544,000 bits per second) while lowering costs at the 
same time. 

Network Connections 
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Figure 15 illustrates the increase in network connection speed over time. 

Voice 

On the voice side of the network, 37 Private Branch exchanges (PBX) and 246 smaller key 
systems connect to SummitNet II to provide traditional voice services for the state Voice PBX 
and key systems. PBX servers have a much longer life than data servers. Some are used for more 
than 20 years. Individual components and software are upgraded within the same chassis. 
Features and functionality of newer systems including Voice Over Internet Protocol (VOIP) are 
becoming mature while costs are dropping. VOIP allows the transfer of voice traffic over lines 
that are typically used for data traffic. The Internet is currently carrying voice traffic through 
VOIP. Proper planning based on accepted standards should ensure the state's continued success 
in its use of its telecommunications infrastructure to reach across Montana. 

Internet Access 

Up until January of 2002, the state's Internet utilization grew at a modest but steady rate. By July 
of 2003 the growth started to accelerate, more than doubling by 2006. This growth mirrors the 
growth in Montana's e-Government services as well as a greater dependence on the Internet as a 
means of conducting research, communicating, and an increase in the amount of electronic data 
being sent to citizens, federal agencies, and private companies. Use of the Internet as a key 
strategic communications vehicle will continue to fuel its rapid growth. This trend is not expected 
to change in the foreseeable future. Because the Internet is becoming such an integral part of 
everyday business in every state agency, a second Internet access point in Billings was added as a 
backup in case the primary link fails. Current utilization of the network is between 60 and 70 
percent. 
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Internet Utilization Growth 
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Figure 16 illustrates the Growth in Internet Utilization 

Interactive Video 

The Montana Educational Telecommunications Network (METNET) is an H.320 and H.323 (a 
national transmission standard for video data) compliant subscription service that supports both 
state agencies and the university system's delivery of two-way interactive distance learning 
classes, hearings, and meetings. The system uses the SummitNet II infrastructure to connect 16 
conference facilities in 13 cities across Montana. 

There is an increasing emphasis on the use of network and computing services to support the 
administrative and business needs of the state, IT employees, citizens, and businesses. There is an 
increased demand of video, audio, and high definition graphics. The state needs to invest in 
infrastructure and support services if it is to meet the changing expectations of those accessing 
government services and information. 

Investments in transport services, management tools, supporting infrastructure, and people have 
been frozen for more than six years. We will need to make the one-time investments to update 
the current IT support structure and increase on-going operational budgets in order to meet the 
increasing demand being placed on the network. 

One solution to this problem is to utilize a high speed optical network across the state with 
circuits capable of delivering data at 20 GPS. The "Northern Tier Initiative" utilizes existing 
infrastructure in a cooperative effort with the education and research community. The relatively 
low cost of using the existing Northern Tier backbone will allow for a larger amount to be spent 
on local connectivity. 
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Figure 1 7 illustrates Montana 's part in the Northern Tier Initiative 

ITSD Data Storage Environment 

Data storage demand has grown dramatically in recent years. ITSD and agencies are using 
Storage Area Network (SAN) technology to ease the administrative burden, share files across 
multiple servers, and provide advanced storage features. Recent improvements in the Capitol 
complex network make it possible to centralize agency storage in ITSD to realize increased 
economies of scale. 

IT Staffing 

The Legislative, Judicial, and Executive branches currently employ approximately 830 staff to 
support their IT systems. The University System is not included in this total. Overall, the state 
has 6.5 percent of all employees specializing in supporting the IT infrastructure. Gartner's 2005 
survey found the percentage of state IT employees is usually 7 percent to 8 percent of the total 
employee population. 

Montana is significantly lower because Montana continues to rely heavily on outside contractors. 
The equivalent of 221 IT FTEs is being employed by agencies through contracting. Although 
contractors comprise 22.2 percent of all IT staffing, they consume 50 percent of the funds spent 
on IT staffing. In fiscal year 2006 the state spent more than $34.6 million on private IT 
contractors, 25.2 percent of the total IT expenditures for the state. Other states average only 6.7 
percent on outside contractors. 

Recruitment of IT professionals with the necessary IT skill is the largest staffing problem 
identified by agencies. Anecdotal evidence of small candidate pools, large percentages of 
unqualified candidates, and repetitive hiring efforts are common across many agencies. Several 
agencies have been unable to hire IT project managers with sufficient skills to manage their 
largest IT projects. Many IT managers attribute existing salary limits as a significant aspect of 
their hiring problem. 
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IT Expenditures 

Based on data from the Statewide Accounting, Budgeting and Human Resource System 
(SABHRS) Montana's total IT expenditure for fiscal year 2006 was $121,720,749, a growth of 
5.1 percent annually since fiscal 2004. Montana IT expenditures are following a predictable 
historical trend and remain a fairly constant 2.8 percent of state operating expenses. Montana's 
total IT expenditure of 7.3 percent of all operating expenditures is in line with other states, 
according to Gartner. Gartner's surveys show that states spend between 6-7 percent of their total 
operating budgets on IT. The following chart illustrates the agencies with the highest IT 
expenditures. 



IT Expenditures in Millions 




Health & Transportation Justice Labor & 
Human Industry 

Services 



Revenue Admin. Fish, Wildlife Judicial Secretaryof Corrections 
(excluding & Parks State 

ITSD) 



Figure 18 illustrates the top ten agencies with the highest IT expenditures (A complete list of IT 
expenditures by agency can be found at appendix D.) 

Figure 19, below, is a breakdown of IT expenditures by categories. The graph also compares 
Montana's expenditures to the average of other states from Gartner's 2005 survey. Montana 
varies significantly from other states in two areas: 

• Montana has a very large dependency on contracted services. As a percent of total IT 
expenditures, Montana spends almost 4 times as much on contractors as do other states. 

• Montana's expenditures on packaged software (12.8%) are far less than what other states 
spend (20.3%). Montana appears to be relying on custom built software instead of 
purchasing standard packages. 



17 



50% 



40% 



30% 



20% 



10% 



Fiscal 2006 IT Expenditures - Type 




Personal Services Contracted 
Services 



Software Telecommunications Hardware 
Maintenance 



Mscellaneous 



I Montana ■ All States 



Figure 19 illustrates IT expenditures by type compared to other states. 

Major Information Technology Projects 

Major IT projects for Montana are primarily defined as projects requiring a minimum of 
$300,000 in funding over the upcoming biennium. The funding can come from a variety of 
sources, including state funds, federal funds, and user fees. 

Montana is entering a new era, with projects defined by greatly increased IT expenditures brought 
on by the need to replace many aging mainframe systems. Among the major systems, four are 
from Health and Human Services, with one each from Justice and Revenue. 

• Child & Adult Protective Services (CAPS) $33. 5M 

• Welfare (TANF) S16.2M 

• Medicaid Management System (MMIS) $70.0M 

• Foods Stamps $13. IM 

• Free Electronic Filing of Income Tax $6.8M 

• Motor Vehicle & Driver Licensing (MERLIN) $I5.9M (currently in progress) 

In addition to agency application development efforts, DOA/ITSD is proposing two major IT 
infrastructure projects. 

The first major infrastructure proposal calls for the construction of new facilities in Helena and in 
an undetermined Eastern Montana location to house the enterprise services provided by ITSD. 
The estimated investment needed for these new centers is $25 million. The Helena facility would 
house the enterprise data center, a network operations center, and a voice telecommunications 
operations center. The facility has 15,000 square feet of raised floor, and would house 
approximately 100 ITSD Operations staff plus an estimated 30-50 technical staff from other 
agencies. If feasible, space for the 60 other non-operational ITSD staff would also be made 
available. The remote facility will house an enterprise data center, a backup network operations 
center, and a backup voice telecommunications operations center and be located somewhere in 
eastern Montana. Initial size of the remote facility is estimated to be 5,000 square feet. 
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The second is a major network upgrade that would use the old Touch America fiber network and 
is known as the Northern Tier Project. At a projected cost of $6.7 million, it would power up the 
dark (dormant) fiber along highway 1-90 to replace or enhance our current backbone network that 
is approaching its capacity. This is a significant upgrade that would result in a 200 fold increase 
in network capacity and would enable numerous new uses of technology and solve current 
"bandwidth" problems. 

The governor's budget also includes $7 million as the state's 50 percent matching share the 
development of a supercomputer site at Montana Tech. IBM has offered the opportunity to install 
a supercomputer in Butte for research and higher education. 

A complete summary of all major IT projects can be found in appendix G The Office of Budget 
and Program Planning (OBPP) assembled a list of projects that would be funded through the 
Executive Planning Process and are included in the governor's budget proposal. Some projects 
are funded outside of the EPP process. These projects were identified during the spring of 2006 
as part of the IT planning cycle. Projects on both lists will be reviewed and funded through the 
2007 legislative session. 

Appendix F contains a summary of all the major IT projects for fiscal 2005 and 2006. For the 
past three years agencies and ITSD have been focusing on improving their project management 
practices and the efforts have paid dividends. During this period, no IT projects were terminated 
or failed to deliver the required system. 
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Other IT Issues 

The Evolving Role of State Chief Information Officers 

Among states throughout the country, the tension between centralization and decentralization 
persists, with the trend toward centralization becoming more widespread. Because of cost 
pressures, centralizing the management of government IT assets and functions is popular but not 
always appropriate. Ultimately, the CIO's role and duties should align with the expectations of 
senior government officials. It is important for the CIO to provide the kind of leadership for the 
state that is in line with the particular stage of the state's evolutionary process. An Enterprise CIO 
and centralized IT management both require an explicit mandate from political leaders of the 
state. 

Open Source Software in Government 

Open Source (OS) is an alternative to the proprietary approach to software development and 
licensing. The Open Source method of developing and distributing software makes application 
source code available to all interested parties at no cost. OS operating systems and web server 
products have been very successful throughout the IT industry. 

By contrast, proprietary software vendors, such as Microsoft, do not release their source code. 
They perceive that doing so will endanger their intellectual property and the potential revenue 
stream it produces. They also believe it would endanger the quality of the product. 

In 2003 the state of Montana established Linux, an open-source software product, as a standard 
product to be used for database and web server implementations. ITSD presently has about 75 
servers running these products, and many agencies do as well. The use of office productivity 
open-source software has not yet had the same success as OS operating systems and web server 
applications. ITSD recommends that a study be conducted to explore the use of open-source 
productivity applications and recommend its role in the state enterprise. 

Records Management 

As the state's executive, legislative, and judicial offices perform their missions, they produce 
official records and information representing important business assets supporting government 
operations. Each agency is responsible for managing the records it creates and receives. State 
agencies currently use disparate media, formats, and processes to manage their records. This 
practice has the potential for exposing agencies to considerable risks to their operational and 
mission-related responsibilities. To mitigate these risks, agency decision-makers need guidance 
in the form of defined Records and Information Management (RIM) policies, standards, and 
procedures that are applied consistently across the state government enterprise. 

To begin a direction for state government, the Secretary of State's office intends to formulate an 
Electronic Records and Information Management (eRIM) Task Force that will help outline needs, 
priorities, funding, and risks. The intent is that this group will give direction for agencies that 
will promote and enable enterprise-wide compliance, continuity of government, content and 
document management, and digital preservation. The goal is to bring process improvement and 
business efficiencies to agencies and employees by way of standardization, workflow, retention 
application, education and training. 
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The Secretary of State's Office proposes to work closely with the Department of Administration 
Information Technology Services Division (ITSD) for the purpose of associating electronic 
records and information management (eRIM) requirements with information technology (IT) 
capabilities. The objective will be to enhance compliance across the enterprise with state and 
federal requirements. 

Real ID 

Enacted in May of 2005, the Real ID Act requires states to adopt certain standards, procedures 
and requirements for issuing drivers licenses and identification cards if they are to be accepted as 
identity documents by the federal government. In essence, the Act establishes a national identity 
card. After May 1 1 , 2008, a federal agency may only accept, for official purposes, state licenses 
or identification cards that meet requirements specified in the Act. 

The Department of Homeland Security has said that states, not the federal government, must bear 
implementation costs for Real ID. The American Association of Motor Vehicles Administrators 
has estimated that it will cost Montana a one-time amount of approximately $5.8 million for 
implementation of Real ID. On-going annual costs for Montana are estimated to be $2.9 million. 
These estimates include both IT and non-IT costs. Additionally, if Montana adheres to the DHS 
identification card specifications, there will be an additional one-time cost of $2.9 million and on- 
going costs of $2.1 million annually. 

There could be some push-back from some states regarding implementation of Real ID standards, 
with some states choosing not to implement Real ID. Whether or not Montana chooses to 
implement federal requirements for Real ID will be a policy decision made by the state 
legislature. Montana already meets many of the Real ID standards, so it will be less difficult for 
Montana to comply than it will be for some other states. 

Security - National and Local Issues 

Information is one of the most valuable assets a company or government may possess. While 
'information' covers a broad spectrum, there is an ever increasing focus on maintaining the 
security of what is considered sensitive data, including: 

• social security numbers 

• personal health information 

• credit and debit card numbers and pins 

• passwords 

Businesses and governments would not be able to conduct meaningful operations without access 
to the information required to support defined business functions. 

Unauthorized access to, or inappropriate use of, sensitive information is on the rise nationally. A 
great deal of planning and resource expenditures is required in order to protect the state's 
systems. The Office of Cyber Protection (OCP) estimates that there are nearly 2 million attempts 
daily to access the state's information systems defensive wall. The majorities of these are 
automated attempts and are reasonably easy to thwart, but many are carefully designed and 
require much more sophisticated methods of protection. 

It is far easier to maintain the trust and confidence of those to whom the information is directly 
linked, as well as the public in general, by proactively preventing security breaches than it is to 
regain that trust after a 'security incident' occurs. Repairing the damage is both costly and 
difficult to achieve. 
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Data security legislation only exists at the state government level, with 34 states having passed 
such laws. However, their main intent has been to mandate consumer notification of a breach and 
not the issue of prevention. While this subject is being debated at a national level, with seven 
bills under consideration by Congress, progress has been slow. 

It is incumbent upon those responsible for maintaining state information security to remain ever 
vigilant while continuing to craft and adhere to the necessary policies and procedures which will 
insure the highest level of confidence possible. 

Security Policies 

The state has been entrusted with the stewardship of a large amount of sensitive information. This 
responsibility requires adherence to adequate safeguards to insure its security. Achieving and 
maintaining the highest level of security is only possible when everyone who has access to the 
systems, data, and networks understands these issues and knows what is expected of them. If 
users are not sure of what is expected of them, there is a high likelihood of them making poor 
decisions. Those decisions may include downloading and installing unapproved software, sharing 
sensitive information via e-mail, visiting malicious or inappropriate websites, and other activities 
that puts our information at risk. 

The most effective and appropriate means of keeping employees informed is through the use of 
readily accessible, well thought out and documented guidelines, standards, and policies. The 
intent of any policy must be crystal clear and should be adequately reflected throughout a broad 
base of like-minded policies. 

The state has made recent progress in this area with the creation of an interim policy on Security 
of Sensitive Data. 

Policies presently under development include: 

• Acceptable Use 

• Physical Security 

• User Rights Standards 

• Internet Filtering 

• Collaboration Tools 

• Streaming Media Content Creation. 

New administrative guidelines for the development of policy to establish and implement 
statewide Information Technology policies and standards have also been recently established. 

Development of policies addressing the protection of the state's information assets is continuing. 
To be effective, these policies must contain adequate and reasonable auditing capabilities along 
with meaningful enforcement and penalty provisions. Unwavering support from the highest levels 
within the state will be necessary to insure future success. 

Protection of sensitive data entrusted to the state has been and must continue to be of paramount 
importance. While it is the state's responsibility to craft and maintain the necessary policies, it 
remains incumbent upon the individual to read, understand, and follow them. 
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Geographic Information Technology Enterprise Infrastructure 

The use of Geographic Information Technology (GIT), whether Geographic Information Systems 
(GIS), Global Positioning Systems (GPS), Remote Sensing or other specialized areas is rapidly 
expanding throughout the state. This expansion is seen in both traditional areas like natural 
resources and emergency response, and in new areas like economic development and health care. 

GIT, whether delivered via the Internet or more traditional map products, provides a very visual 
approach to supplying the geographic component that is inherent in almost every state business 
process or important state issue. Because of a rapidly changing GIT environment, the Montana 
Spatial Data Infrastructure (MSDI), the Montana Land Information Act (MLIA), the Montana 
Land Information Advisory Council (MLIAC) and GIS Coordination at ITSD, need to be fused 
together through a Common Operating Picture (COP) to better serve Montana's needs. 

Explosive growth in GIT and the need to integrate with federally mandated enterprise architecture 
will require the State to adapt and employ new technologies such as web services, federated 
approaches to the collection, maintenance and distribution of data, and service oriented 
architectures. 

The Montana Spatial Data Infrastructure (MSDI) serves as the foundation for base geospatial data 
in Montana. A reliable infrastructure theme, stewardship and leadership, along with long-term 
funding for collection, maintenance, integration, enhancement, and dissemination are needed. To 
assist in the infrastructure development, the Montana Land Information Act (MLIA) is 
proceeding under Administrative Rule established in September 2006. A 2007/2008 Land 
Information Plan has first round grants to be awarded in May, 2007. MLIA funds will not 
ultimately meet all the needs of the Spatial Data Infrastructure and a federated enterprise GIT 
community, so other funding sources must be identified. The Montana Land Information 
Advisory Council must remain engaged in the Montana Land Information Act and infrastructure 
processes, while actively adapting current policy and vision to a changing environment. 

A federated enterprise GIT community demands clearly defined roles and responsibilities that 
may differ from current roles assumed over the years. Adopting the recommendations from 
Montana's Chief Information Officer's Committee on a GIS Common Operating Picture, and the 
hiring of a State Geographic Information Officer (GIO) will help clarify those roles and 
responsibilities leading to effective and efficient GIT development now and in the future. 
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Appendices 

Analysis of IT Infrastructure A 

Agency IT Staffing B 

Agency IT Expenditures for Fiscal 2006 (chart) C 

IT Expenditures as a Percent of State Operating Expenditures D 

IT Recommendations and 2009 Biennial Budget Requests E 

Major IT Projects for Fiscal 2005-06 F 

Major IT Projects for Fiscal 2008-09 G 

ESSC Proposal H 



The appendices have not been printed as part of this report. They can be found on ITSD's web 
site at http://itsd.mt.gov/techmt/biennialreport.asp. If you wish a printed copy of an appendix, 
please contact: 



Kyle Hilmer 

Chief of the Policy and Planning Services Bureau 

406-444-5476 

E-mail: KHilmer@mt.gov 
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